We Keep Coding

What is difference between invalid and invalidated session

How sessions become invalid?
Invalidated session is an invalid session?
What is difference between invalid and invalidated session?
Why invalid session is not null?

When you invalidate the session, doesn't mean that the reference of the session become null.
Invalidates this session then unbinds any objects bound to it.
When you invalidate, it just remove all the data inside it and itself gets removed from the session pool. So when you ask for the session in current context, you don't receive any session as the session invalidated.
Why invalid session is not null?
If you have the session reference is in your hand, it can't be null. You can still access it, however the session data gets vanished. Once you again call/look for session, for ex request.getSession(false), you'll receive a null as session as the earlier session validated.

After response.sendRedirect(redirect) session becomes null

Here request is an object type which extends HttpServletRequest. This is the sequence of code.
HttpSession session;
session = request.getSession(false);
response.sendRedirect(redirect);
session = request.getSession(false);
In the first line, able to get the valid session value. But after 2nd statement sendRedirect execution. session object is becoming NULL in the 3rd statement.

For the redirected request to come back and attach to the same session, it needs a session ID, usually carried in a JSESSIONID (or another name) cookie or in the URL as a parameter.
This cookie or URL parameter should be added by the servlet container and you should not have to add it yourself.
If you do not see the cookie in your browser, and you are not attaching the JSESSIONID to the URL, then it is creating a new session with each request, and not attaching to the same session

jsessionid ignored

I'm using a URL with a jsessionid, eg.
http://localhost:8080/myservlet;jsessionid=123
Yet whenever I read the session ID in the HttpServletRequest the value is never 123, but instead a generated session ID, eg. B663A96D3FBC84B4A427C0810EAB9073.
Why is my jsessionid being ignored?

That's because you specified a session ID for which no concrete HttpSession object exist in server's memory. In other words, the given session ID is unknown/invalid. You need to specify a session ID which refers a valid and existing HttpSession object in server's memory.
Assuming that you do have a valid HttpSession with ID B663A96D3FBC84B4A427C0810EAB9073 currently in server's memory, then the following link will work and give the enduser access to exactly that HttpSession:
http://localhost:8080/myservlet;jsessionid=B663A96D3FBC84B4A427C0810EAB9073

My guess would be that most application servers these days default to using cookies for session tracking, not URL rewriting. So if your request contains both a session cookie and a JSESSIONID in the URL, it will probably use the one from the cookie. Check the documentation of your appserver for how to configure this.

Java HttpSession

Is HttpSession in java servlet is created only after
HttpSession s = request.getSession();
?
In my code I didn't write that, but when I use if (request.getSession(false) == null) ..., it doesn't work. Why?

A HttpSession is created when calling request.getSession().
But if you access a JSP by default it will automatically create a session.This behaviour can be disabled by using: <%# page session="false">
Are you using JSP?

Read JavaDocs, it says clearly:
This says, request.getSession()
Returns the current session associated with this request, or if the request does not have a session, creates one.
And the other variant request.getSession(isCreate)
Returns the current HttpSession associated with this request or, if there is no current session and create is true, returns a new session.
If create is false and the request has no valid HttpSession, this method returns null.
To make sure the session is properly maintained, you must call this method before the response is committed. If the container is using cookies to maintain session integrity and is asked to create a new session when the response is committed, an IllegalStateException is thrown.
Update
On a bit research, I have found that Session is not created unless request.getSession() is called somewhere. Since, The servlet container uses this interface to create a session between an HTTP client and an HTTP server. There are good chances that your Servlet container creates the Session for you by default.
refer:
Java Doc HttpSession
Discussion on JavaRaunch: is HttpSession created automatically?
But, to be safer side, use request.getSession() to get session, and use request.getSession(false) only when you need to verify if a session has already been created.

In addition to Nishant's answer note that session can be created implicitly by JSP pages unless you configured them not to create a session with <%# page session = "false" %>.

To make it complete:
session is not created, unless you call request.getSession(), in your servlet, use request.getSession(false) to get existing session without creating new session
if you use JSP page, session is automatically created for you - variable session - unless you specify <%# page session="false" %>
even if your session is created automatically, you can use session.isNew() to find out, if it has been newly created

Try to remove session cookies from browser and make another test. If it does not work then some other component is creating a new session before that call.

Ensure a new session every time the user connects to a Servlet

I've a JSP/Servlet Web App that consist of more than one servlet (and some JSPs)
I need to create an new HttpSession whenever the users access servlet A, knowing that, servlet A is the home page (i.e. he access it as the first servlet/page in the application).
So far so good, I can write the following code at the start of the servlet A:
HttpSession session = request.getSession(false);
if (session == null) {
logger.debug("starting new session...");
session = request.getSession();
// other stuff here
}
But the problem is, if the user didn't close his browser (even if he closes the tab - in Firefox for instance - the session will still be open), so when he try to open my site again, the last session will be re-used (in the range of session timeout of course), and this I don't need. I need that whenever he accesses Servlet A, he gets a brand new HttpSession.
But unfortunately, he may access this servlet twice per session based on some scenario!

It seems to me that you should not be using session for this purpose. Perhaps you can add a parameter to request (i.e. transaction id) and pass it around trough all your related requests, so when user would close page the transaction id would be gone. Then you can store any data associated with given transaction id in the http session or elsewhere and could also clean it after some time.
The spring framework has an abstraction called bean scope, which seem like a good fit for your scenario, so you can create a custom scope for your transaction (or user's session) and store all the data in some bean scoped with such custom scope.

You should store some information (attribute) in the session that it's been used. And if it has been, invalidate
HttpSession session = request.getSession();
Object isOld = session.getAttribute( "isOld" );
if ( isOld != null )
{
session.invalidate( );
// Recreate session
session = request.getSession( );
}
session.setAttribute( "isOld", new Object( ) );